Re: [Nfsen-discuss] Live profile stuck in "rebuild" state, graphs are empty
Netflow visualisation and investigation tool
Brought to you by:
phaag
|
From: Tristan R. <Tri...@we...> - 2006-04-06 17:13:10
|
Peter,
Thanks for taking the time to help me. I am looking forward to the
next version, which you say will include the ability to add/delete
sources.
I decided that I needed to get NFSEN up and running again, so I
archived the profile directories and then installed NFSEN from scratch.
Now I have a working NFSEN 1.2.4 system, and it looks beautiful.
Speaking of which, does anyone have some great color combinations that
are both easy to read and look professional? I tried my best to choose
colors, but I bet there is a better color pallete than mine.
Thanks for the great tools and your support.
Tristan
>>> Peter Haag <ha...@sw...> 04/05/06 4:38 AM >>>
-----BEGIN PGP SIGNED MESSAGE-----
Hi Tristan,
Adding/deleteing sources to NfSen up to and including version 1.2.4 is
not
supported. Upgrade to lates nfsen-snapshot if you want to play with
this feature.
Locking/Unlocking a profile is only recommended is you really know what
if this
solves your problem! Otherwise you may stuck and freeze nfsen.
To bring it back alive:
1. Get the process id of the master nfsen-run process in
$VARDIR/run/nfsen-run.pid
2. Kill -TERM the master nfsen-run process - should exit normally.
3. Unlock the profile: ./nfsen -m live -U
4. Rebuild the profile: ./nfsen -r live
5. Start nfsen-run: ./nfsen-run
- Peter
- --On March 30, 2006 11:44:20 -0700 Tristan RHODES
<Tri...@we...> wrote:
| Greetings,
|
| Recently, I added a new source to my NFSEN. (Let me know if I
followed
| the wrong procedure)
|
| I edited nfsen.conf, added the source, and then ran the install.pl
| file. Next, I unlocked the live profile, rebuilt it, and locked it
| again. Now it appears that the live profile is stuck in "rebuild"
| state, and the graphs are empty. Any ideas why this is, and how to
fix
| it? My first idea was that the gigabytes of data were too much for
it
| to rebuild while capturing new data. Is this possible? I also
noticed
| that the reported size is strange ( -21409792).
|
| #
| # Profile live.
| #
| name live
| tstart Thu Jan 26 15:05:00 2006
| tend Thu Mar 30 08:55:00 2006
| updated Thu Jan 26 14:55:00 2006
| filter <none>
| expire 0 hours
| size -21409792
| maxsize 125.0 GB
| sources TER1:D1VNR:CSR100:D2S1:TEDC:LPR1:SHR1
| type live
| locked 1
| status rebuild
|
|
| Thanks for the great tool, and for your help on this question.
|
| Tristan Rhodes
|
|
|
| -------------------------------------------------------
| This SF.Net email is sponsored by xPML, a groundbreaking scripting
language
| that extends applications into web and mobile media. Attend the live
webcast
| and join the prime developer group breaking into this new coding
territory!
|
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
| _______________________________________________
| Nfsen-discuss mailing list
| Nfs...@li...
| https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
|
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Limmatquai 138, CH-8001 Zurich, Switzerland
E-mail: pet...@sw... Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)
iQCVAwUBRDOeCf5AbZRALNr/AQHH/gP+I+xKbk1GPchCA9YaHHMlvOt1HX8KI77n
+bbjXSaBJcNldvYpA5wBVXkZg0yREyEIv1wLd2/0ADWdalJTt5cb3llgpv4xbmqm
w+tIEley5CvXmmCRQKFKODDjZMXM9WMh7GgWutZudydxMLl5yRmrzGf4PjOQmYvG
3ij3SIpoFoQ=
=PFsT
-----END PGP SIGNATURE-----
|